back to top
HomeTechNVIDIA NemoClaw runs OpenClaw inside a secure sandbox and setup takes one...

NVIDIA NemoClaw runs OpenClaw inside a secure sandbox and setup takes one command

NVIDIA NemoClaw runs OpenClaw inside a secure sandbox and setup takes one command
Mohit Geryani
By Mohit Geryani
0
Last updated:
- Advertisement -

Earlier this year OpenClaw became the most starred project on GitHub faster than anything before it. Developers loved it. Companies started deploying it. Then a senior AI safety researcher at Meta let it run on her machine and it deleted her emails. A security researcher hijacked a running instance in under two hours.

Enterprises wanted AI agents. They just did not want ones they could not control.

NVIDIA’s answer to that is NemoClaw. One curl command and you have OpenClaw running inside a sandbox where it cannot touch your files, cannot make unauthorized network calls, and cannot escalate privileges without your approval.

Table of contents

What NemoClaw actually is

NemoClaw is an open source reference stack built by NVIDIA that runs OpenClaw inside a secure sandboxed environment. Think of it as a controlled container where your AI agent can work freely without being able to touch anything it should not.

It is not a replacement for OpenClaw. It is a secure wrapper around it. When you install NemoClaw it actually creates a fresh OpenClaw instance inside the sandbox automatically. The agent still does everything OpenClaw does. It just cannot go rogue while doing it.

NVIDIA released it on March 16 as an early alpha preview under Apache 2.0 license. It is not production ready yet and NVIDIA is upfront about that. Interfaces and APIs may change as they iterate. But it is available now for developers and enterprises who want to start experimenting with safe agent deployment.

NemoClaw

What makes it different from just running OpenClaw directly

Running OpenClaw directly means trusting the agent completely. It can read your files, make network requests, install things, cross into systems it probably should not touch. That is exactly what happened at Meta.

NemoClaw puts three walls around that.

The first is network control. Every outbound connection the agent tries to make is blocked by default unless you have explicitly allowed it. If the agent tries to reach an unlisted host, OpenShell blocks the request and surfaces it in the interface for you to approve or deny in real time. You see exactly what your agent is trying to connect to before it connects.

The second is filesystem isolation. The agent only has access to the sandbox and tmp directories. Everything else on your machine is locked. It cannot read your documents, cannot touch your code outside the sandbox, cannot access anything you have not deliberately placed inside its reach.

The third is process protection. Privilege escalation is blocked. Dangerous system calls are blocked. The agent cannot quietly give itself more permissions than it started with.

What makes this genuinely useful is that all three layers are declarative. You define the policy in a YAML file. You can update network rules while the sandbox is running without restarting anything. You are in control of exactly what the agent can and cannot do at all times. That is the thing OpenClaw never had.

What you actually get when you install it

Before you install, check your hardware. You need at least 4 vCPU, 8GB RAM and 20GB free disk space. NVIDIA recommends 16GB RAM and 40GB disk for comfortable use. The sandbox image alone is around 2.4GB compressed and during setup Docker, k3s and the OpenShell gateway all run simultaneously, so machines with less than 8GB RAM can run into memory issues.

For software you need Linux Ubuntu 22.04 or later, Node.js 20 or later, npm 10 or later and Docker installed and running. On macOS Apple Silicon, Colima and Docker Desktop are the recommended runtimes. Windows WSL users need Docker Desktop with WSL backend. Podman on macOS is not supported yet.

Once installed you get a running sandbox environment with a fresh OpenClaw instance inside it, the OpenShell gateway managing all security policies, and NVIDIA’s Nemotron model connected via the NVIDIA Endpoint API. You will need a free NVIDIA API key from nvidia which the installer prompts you for during setup.

After setup your terminal confirms everything running with a summary showing your sandbox name, the model connected and the commands to get started.

How to get it running

This one is genuinely simple compared to most open source setups. If you are comfortable with terminal you will be up and running in minutes.

Before you start, make sure you have:

  • Linux Ubuntu 22.04 or later, macOS Apple Silicon, or Windows WSL with Docker Desktop
  • Node.js 20 or later
  • npm 10 or later
  • Docker installed and running
  • A free NVIDIA API key , get this before you start, the installer will ask for it

Step 1: Install NemoClaw

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

Get your NVIDIA API key before Step 2: Free from Nvidia. The onboard wizard asks for it and you cannot complete setup without it.

Step 2: Run the onboard wizard

nemoclaw onboard

This is where everything gets configured. Sandbox creation, inference setup, security policies and API key entry all happen here.

Step 3: Connect to your sandbox

nemoclaw my-assistant connect

This drops you into the sandbox shell where your OpenClaw agent is running.

Step 4: Start the agent

For interactive chat open the TUI:

openclaw tui

For a quick single message test:

openclaw agent --agent main --local -m "hello" --session-id test

If something goes wrong:

nemoclaw my-assistant status
openshell sandbox list

Those two commands tell you exactly what is happening at both the NemoClaw and OpenShell level.

To uninstall completely:

curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash

Should you install it today

NemoClaw is alpha software. NVIDIA says it plainly and they mean it. Do not run this in production.

But if you are a developer curious about safe agent deployment, install it today. The one command setup works, the sandbox is real and getting comfortable with this before it matures is worth your time.

Enterprises evaluating AI agents should watch this closely. The security model is exactly what the industry has been asking for. Just wait for a stable release before committing.

Don’t miss any Tech Story

Subscribe To Firethering NewsLetter

You Can Unsubscribe Anytime! Read more in our privacy policy

LEAVE A REPLY

Please enter your comment!
Please enter your name here

YOU MAY ALSO LIKE

The Biggest AI Companies Are All Building Their Own Chips. That’s Not a Coincidence.

Mohit Geryani - 0
Anthropic confirmed this week it's hiring a custom silicon team to design chips for running Claude. The announcement was quiet a job listing, a spokesperson confirmation, no big launch event. Easy to file under "interesting but expected" and move on. But zoom out for a second. OpenAI shipped its first custom inference chip in June. Google has been running models on its own TPUs for years. Meta has designed and deployed its own silicon. Mistral is reportedly exploring the same path. And now Anthropic. Five of the most important AI labs in the world, all arriving at the same decision, within roughly the same window. None of them are copying each other. All of them looked at the same competitive landscape and reached the same conclusion independently. That kind of convergence doesn't happen by accident. It happens when an entire industry agrees that the thing everyone assumed was someone else's problem is actually the problem and that whoever solves it first has an advantage that's very hard to close later.
AI Was Supposed to Stop Cheating. Instead, 58,000 Students Must Retake Their Exams

AI Was Supposed to Stop Cheating. Instead, 58,000 Students Must Retake Their Exams.

Mohit Geryani - 0
UNAM runs the largest university in Mexico. Every year, hundreds of thousands of students take an entrance exam that determines whether they get in. This year, for the first time, the whole thing went remote. They deployed a lockdown browser, AI webcam monitoring, and one human supervisor per 150 applicants. The kind of setup that sounds serious on paper. Then the scores came in. Students hitting 100 or above jumped from 3.5 percent in previous years to 16.3 percent this year. At the very top end, scores of 110 or higher went from 0.9 percent to 5.5 percent. Not a small shift. Not noise. A roughly fivefold increase in top scores, in one year, under one new format. An expert commission investigated. Their conclusion: administer the entire exam again, in person, to around 58,000 people. The rector apologized to students who hadn't cheated. They now have to prepare for and sit another exam anyway.
Claude Chats Ended Up on Google Search. Here's How It Happened

Claude Chats Ended Up on Google Search. Here’s How It Happened.

Mohit Geryani - 0
A single line typed into Google was all it took. Type "site:claude.ai/share" into the search bar, and over the weekend, it surfaced a long list of conversations people had shared through Claude, Anthropic's AI chatbot. Not conversations they'd shared with the world on purpose. Conversations they'd shared with one person, or thought they had.Some of what turned up reads like exactly the kind of thing you'd never want indexed anywhere. Medical records. Children's names and phone numbers. Internal company documents marked for employees only. This wasn't a hack, no one broke into anything. It was a feature working exactly as built, surfacing exactly what people had typed into it, in ways most of them almost certainly never intended.